(Definition) Article 1 Terms used in these rules are governed by the terms used in the Act on the Protection of Personal Information (referred to below as the "Act").

(Standards Concerning the Letters, Numbers, Symbols or Other Codes Representing the Physical Characteristics of an Individual that are Converted Into Codes for Use in Computers) Article 2 Standards prescribed by Rules of the Personal Information Protection Commission under Article 1, item (i) of the Order for Enforcement of the Act on the Protection of Personal Information (referred to below as the "Cabinet Order") are that codes are converted for the purpose of being provided for use in computers in an appropriate scope by using an appropriate method so as to ensure the level of the ability of the codes to identify a specific individual.

(Characters, Letters, Numbers, Symbols or Other Codes Stated in a Certificate of Insured Person of Long-Term Care Insurance to Be Assigned Differently for Each Recipient) Article 3 Characters, letters, numbers, symbols or other codes prescribed by Rules of the Personal Information Protection Commission under Article 1, item (viii) of the Cabinet Order are to be the number of the certification of an insured person and the insurer number prescribed in that item.

(Characters, Letters, Numbers, Symbols or Other Codes Equivalent to a Passport Number) Article 4 Characters, letters, numbers, symbols or other codes prescribed by Order of the Personal Information Protection Commission under Article 1, item (x) of the Cabinet Order are to be those stated in the following: (i) insurer number provided for in Article 3, paragraph (11) of the Health Insurance Act (Act No. 70 of 1922) and insured person symbol and number provided for in paragraph (12) of that Article; (ii) insurer number provided for in Article 2, paragraph (10) of the Mariners Insurance Act (Act No. 73 of 1939) and insured person symbol and number provided for in paragraph (11) of that Article; (iii) number of a passport (excluding those issued by the Japanese government) provided for in Article 2, item (v) of the Immigration Control and Refugee Recognition Act (Cabinet Order No. 319 of 1951); (iv) number of a residence card referred to in Article 19-4, paragraph (1), item (v) of the Immigration Control and Refugee Recognition Act; (v) subscriber etc. symbol and number etc. provided for in Article 45, paragraph (1) of the Private School Personnel Mutual Aid Association Act (Act No. 245 of 1953); (vi) member etc. symbol and number etc. provided for in Article 112-2, paragraph (1) of the National Public Servants Mutual Aid Association Act (Act No. 128 of 1958); (vii) member etc. symbol and number etc. provided for in Article 144-24-2, paragraph (1) of the Local Public Care Service Mutual Aid Association Act (Act No. 152 of 1962); (viii) insured person number on an employment insurance-insured person's certificate referred to in Article 10, paragraph (1) of the Ordinance for Enforcement of the Employment Insurance Act (Ordinance of Ministry of Labor No. 3 of 1975); (ix) number of a special permanent resident certificate referred to in Article 8, paragraph (1), item (iii) of the Special Act on the Immigration Control of, inter alia, those who have lost Japanese Nationality pursuant to the Treaty of Peace with Japan (Act No. 71 of 1991).

(Sensitive Personal Information) Article 5 The physical or mental functional disabilities prescribed by Rules of the Personal Information Protection Commission under Article 2, item (i) of the Cabinet Order are to be those disabilities stated in the following: (i) physical disabilities stated in the appended table of the Act for Welfare of Persons with Physical Disabilities (Act No. 283 of 1949); (ii) intellectual disabilities referred to under the Act for the Welfare of Persons with Intellectual Disabilities (Act No. 37 of 1960); (iii) mental disorders or disabilities referred to under the Act on Mental Health and Welfare for Persons with Mental Disorders or Disabilities (Act No. 123 of 1950) (including developmental disabilities prescribed in Article 2, paragraph (1) of the Act on Support for Persons with Developmental Disabilities (Act No. 167 of 2004), and excluding those stated in the preceding item); (iv) disorders or disabilities of a degree of severity specified by the Minister of Health, Labour and Welfare which have arisen due to disease for which no established treatment exists or due to other rare disease as specified by Cabinet Order under Article 4, paragraph (1) of the Act on Providing Comprehensive Support for Daily Life and Life in Society of Persons with Disabilities (Act No. 123 of 2005).

(Person Prescribed by Order of the Personal Information Protection Commission under Article 20, Paragraph (2), Item (vii) of the Act) Article 6 A person prescribed by Order of the Personal Information Protection Commission under Article 20, paragraph (2), item (vii) of the Act is a person falling under any of the following items: (i) a foreign government, a foreign governmental organization, a local government in a foreign country, or an international organization; (ii) a person who is equivalent to an academic research institution, etc. or the equivalent provided for in Article 16, paragraph (8) of the Act in a foreign country; (iii) a person who is equivalent to a person stated in each item of Article 57, paragraph (1) of the Act in a foreign country.

(Situations Likely to Harm Individual Rights and Interests) Article 7 The situations prescribed by Rules of the Personal Information Protection Commission as those that are likely to harm individual rights and interests under the main clause of Article 26, paragraph (1) of the Act are to be those which fall under any of the following: (i) situations in which leakage, loss or damage (referred to below as "leakage, etc." in this Article and paragraph (1) of the following Article) of personal data that contains sensitive personal information (excluding that for which advanced encryption or other necessary measures have been taken for protecting individual rights and interests; the same applies in this Article and paragraph (1) of the following Article) occurred or possibly occurred; (ii) situations in which leakage, etc. of personal data that could cause property damage when the data is wrongfully used occurred or possibly occurred; (iii) situations in which leakage, etc. of personal data (including personal information that a business handling personal information has acquired or intends to acquire and that is going to be handled as personal data) arising from an act conducted possibly for wrongful purposes, against the business handling personal information occurred or possibly occurred; (iv) situations in which leakage, etc. of personal data and the number of persons identifiable by the personal data exceeds 1,000 occurred or possibly occurred.

(Report to the Personal Information Protection Commission) Article 8 (1) When a business handling personal information makes a report under the main clause of Article 26, paragraph (1) of the Act, the business handling personal information must report the matters stated in the following regarding the situations prescribed in any item of the preceding Article (limited to those matters that the business handling personal information is aware of when making the report; the same applies in the following Article) promptly after the business handling personal information becomes aware of the relevant situations. (i) overview; (ii) the details of personal data (with regard to the situation specified in item (iii) of the preceding Article, including the personal information prescribed in that item; the same applies in the following item) that occurred or possibly occurred to have been leaked, etc.; (iii) number of persons identifiable by personal data that occurred or possibly occurred to have been leaked, etc.; (iv) causes; (v) whether there is or possibly be secondary damage and details of the secondary damage; (vi) implementation status of measures to the identifiable persons; (vii) implementation status of public announcement; (viii) measures to prevent recurrence; (ix) other matters that are to serve as reference. (2) In the case referred to in the preceding paragraph, a business handling personal information must report matters prescribed in each item of the preceding paragraph regarding the relevant situation within 30 days after the business handling personal information becomes aware of the relevant situation (or within 60 days if the relevant situation is the one prescribed by item (iii) of the preceding Article). (3) The report under the main clause of Article 26, paragraph (1) of the Act is to be made by the methods prescribed in the following items in accordance with the categories stated in those items: (i) when reporting to the Personal Information Protection Commission; a method using an electronic data processing system (meaning an electronic data processing system connecting a computer used by the Personal Information Protection Commission and a computer used by the reporting person via telecommunications lines) (or a method submitting a written report in accordance with Appended Form No.1 if it is found to be difficult to use an electronic data processing system due to a fault in telecommunications lines, a disaster or other reasons); (ii) when reporting to the competent minister for the business who was delegated authority under Article 26, paragraph (1) of the Act, pursuant to Article 150, paragraph (1) of the Act: a method submitting a written report in accordance with Appended Form No.1 (in the event that another method is prescribed by the competent minister for the business, that method).

(Notification to Other Businesses Handling Personal Information) Article 9 If a business handling personal information gives a notification under the proviso of Article 26, paragraph (1) of the Act, the business handling personal information must notify the matters prescribed by each item of paragraph (1) of the preceding Article promptly after becoming aware of situations provided for in each item of Article 7.

(Notification to Identifiable Persons) Article 10 If a business operator handling personal information gives a notification under the main clause of Article 26, paragraph (2) of the Act, the business operator handling personal information must notify the matters prescribed by Article 8, paragraph (1), items (i), (ii), (iv), (v) and (ix) to the extent necessary for protecting the rights and interests of the relevant identifiable person promptly after becoming aware of the situations provided for in each item of Article 7, depending on the relevant situation.

(Advance Notification Regarding Provision of Personal Data to a Third Party) Article 11 (1) A measure of notifying the information or making it readily accessible under Article 27, paragraph (2) or (3) of the Act is to be carried out as stated in the following: (i) setting a necessary period for a person identifiable by the personal data provided to a third party (referred to as "the identifiable person" in the following item) to request the provision of the data to be discontinued; (ii) adopting an appropriate and reasonable method to enable the identifiable person to recognize matters stated without fail in each item of Article 27, paragraph (2) of the Act. (2) A notification under Article 27, paragraph (2) or (3) of the Act must be given by any of the following methods: (i) a method using an electronic data processing system (meaning an electronic data processing system connecting a computer used by the Personal Information Protection Commission and a computer used by a notifying person via a telecommunications line); (ii) a method submitting a written notification in accordance with Appended Form No. 2 (or Appended Form No. 3 if notifying the provision of personal data was discontinued under Article 27, paragraph (3) of the Act) and an optical disc (including an object that can reliably keep a record of certain matters by a method equivalent to an optical disc; referred to below as an "optical disc, etc.") that has kept a record of matters to be stated in the written notification. (3) If a business operator handling personal information gives a notification under Article 27, paragraph (2) or (3) of the Act by an agent, it must submit to the Personal Information Protection Commission a document (including an electronic or magnetic record; the same applies below: excluding Article 17, paragraph (1), Article 18, paragraph (2), Article 30, Article 47, paragraph (1), Article 48, paragraph (2), Article 54, paragraphs (2), (6) and (7), Article 60, and Article 66, paragraph (2)) verifying the authority of the agent in accordance with Appended Form No. 4. (4) The matters prescribed by Rules of the Personal Information Protection Commission under Article 27, paragraph (2), item (viii) of the Act are to be those stated in the following: (i) a method of updating personal data provided to a third party; (ii) a planned date for starting the provision of personal data to a third party related to the relevant notification to the Personal Information Protection Commission.

(Agent for Business Handling Personal Information in a Foreign Country) Article 12 If a business handling personal information in a foreign country gives a notification under Article 27, paragraph (2) or (3) of the Act, it must appoint a person domiciled in Japan who has the authority to act for it on any action relating to the notification. In this case, that business handling personal information must submit to the Personal Information Protection Commission a document (including a Japanese translation) verifying that it has conferred the authority to represent it on the person domiciled in Japan at the same time as giving the notification.

(Public Disclosure by the Personal Information Protection Commission Regarding Provision of Personal Data to Third Parties) Article 13 Public disclosure under Article 27, paragraph (4) of the Act is to be made through the use of the internet or other appropriate means without delay after a notification has been given under paragraph (2) or (3) of that Article.

(Public Disclosure by a Business Operator Handling Personal Information Regarding Provision of Personal Data to Third Parties) Article 14 A business handling personal information is to disclose to the public those matters stated in the following items in accordance with the categories of the cases stated in those items through the use of the Internet or other appropriate means, promptly after public disclosure under Article 27, paragraph (4) of the Act has been made: (i) when giving a notification under Article 27, paragraph (2) of the Act: the matters stated in each item of that paragraph; (ii) when giving a notification of change under Article 27, paragraph (3) of the Act: matters after the change that are stated in each item of paragraph (2) of that Article; (iii) when giving a notification under Article 27, paragraph (3) of the Act regarding discontinuation of the provision of personal data: a statement to that effect.

(Foreign Country That Has Established a Personal Information Protection System Recognized to Have Equivalent Standards to That in Japan Regarding the Protection of Individual Rights and Interests) Article 15 (1) The country prescribed by Rules of the Personal Information Protection Commission as a foreign country that has established a personal information protection system under Article 28, paragraph (1) of the Act means a country that the Personal Information Protection Commission prescribes as being a foreign country that falls under all of the following items: (i) has established a law, regulation or other rules equivalent to the provisions regarding business handling personal information under the Act, and conditions in the country are found that there are reasonable grounds to believe that the provisions have been enforced in the foreign country; (ii) has established an independent foreign enforcement authority equivalent to the Personal Information Protection Commission, and has established a system for the foreign enforcement authority to provide necessary and appropriate supervision; (iii) is recognized to be able to collaborate and cooperate with Japan based on mutual understanding regarding the proper and effective use of personal information and the protection of individual rights and interests; (iv) is recognized to be able to send and receive personal data mutually and smoothly to and from Japan while ensuring the protection of personal data without restricting the international transfer of personal data beyond the extent necessary for protecting personal data; (v) in addition to those matters provided for in the preceding four items, it is recognized that specifying the country as a foreign country under Article 28, paragraph (1) of the Act will contribute to the creation of new industries and the realization of a vibrant economic society and an enriching quality of life of the Japanese public. (2) When the Personal Information Protection Commission finds it necessary to protect individual rights and interests in Japan in prescribing a country as the foreign country under the preceding paragraph, the Commission can limit the range of personal data that can be provided to a third party in that foreign country without obtaining an identifiable person's consent to the effect that the person permits the provision of the data and can add other necessary conditions. (3) When the Personal Information Protection Commission has prescribed a foreign country under paragraph (1), and finds it necessary to confirm whether the foreign country falls under any item of paragraph (1) and whether conditions added pursuant to the preceding paragraph for the foreign country have been met, the Commission is to perform necessary investigation on the foreign country's systems for protecting personal information or on the corresponding status regarding the conditions. (4) When the Personal Information Protection Commission has prescribed a foreign country under paragraph (1), and recognizes that the foreign country no longer falls under any item of paragraph (1) or that conditions added pursuant to paragraph (2) for the foreign country are no longer being met, taking into account the results of the investigation in the preceding paragraph and other situations, the Commission is to revoke the specification under paragraph (1).

(Standards in the System Necessary for Continuously Taking Measures Equivalent to Those That a Business Operator Handling Personal Information Must Take) Article 16 The standards prescribed by Rules of the Personal Information Protection Commission under Article 28, paragraph (1) of the Act fall under any of the following items: (i) a business handling personal information and a person who receives personal data have ensured, in relation to the handling of the personal data by the person, the implementation of measures in line with the purport of the provisions under Chapter IV, Section 2 of the Act by an appropriate and reasonable method; (ii) a person who receives personal data has obtained certification based on an international framework concerning the handling of personal information.

(Provision of Information at the Time of Obtaining Consent Concerning Provision to a Third Party in a Foreign Country) Article 17 (1) methods of providing information pursuant to Article 28, paragraph (2) of the Act or Article 31, paragraph (1), item (ii) of the Act are a method of provision by electronic or magnetic records, delivering documents or other appropriate methods. (2) Provision of information under Article 28, paragraph (2) of the Act or Article 31, paragraph (1), item (ii) of the Act is conducted for the following matters: (i) name of the relevant foreign country; (ii) information on a personal information protection system in the relevant foreign country obtained in an appropriate and reasonable manner; (iii) information on measures taken by the relevant third party to protect personal information. (3) Notwithstanding the provision of the preceding paragraph, if a business operator handling personal information cannot identify the matter provided for in item (i) of the preceding paragraph, when attempting to obtain consent from an identifiable person pursuant to Article 28, paragraph (1) of the Act, the business handling personal information must provide information on the following matters instead of the matters provided for in that item and item (ii) of that paragraph: (i) the fact that the matter provided for in item (i) of the preceding paragraph cannot be identified and the reason; (ii) if there is information that is to serve as a reference for an identifiable person in place of the matter provided for in item (i) of the preceding paragraph, that information. (4) Notwithstanding the provision of paragraph (2), if a business handling personal information cannot provide information on the matter provided for in paragraph (2), item (iii) when attempting to obtain consent from an identifiable person pursuant to Article 28, paragraph (1) of the Act, the business handling personal information must provide information on the fact and the reason instead of the matter provided for in that item.

(Necessary Measures to Ensure Continuous Implementation of Equivalent Measures by a Third Party in a Foreign Country) Article 18 (1) Necessary measures to ensure continuous implementation of the equivalent measures by a third party in a foreign country under Article 28, paragraph (3) of the Act (including as applied mutatis mutandis pursuant to Article 31, paragraph (2) of the Act following the deemed replacement of terms) are as follows: (i) to periodically check the implementation status of the equivalent measures by the third party and the presence and content of the foreign country's systems that may affect implementation of the equivalent measures, in an appropriate and reasonable manner; (ii) to take necessary and appropriate measure when the third party fails to implement the equivalent measures; and to discontinue the provision of personal data (or information related to an individual if applied mutatis mutandis pursuant to Article 31, paragraph (2) of the Act following the deemed replacement of terms) to the third party when it becomes difficult to ensure continuous implementation of the equivalent measures. (2) methods of providing information pursuant to Article 28, paragraph (3) of the Act are methods of provision by electronic or magnetic records, delivering documents or other appropriate methods. (3) If a business operator handling personal information receives a request under Article 28, paragraph (3) of the Act, the business operator handling personal information must provide information on the following matters to an identifiable person without delay provided, however, that if providing the information is likely to seriously interfere with the proper implementation of the business of the business operator handling personal information, that business operator handling personal information may not provide all or part of the information: (i) methods for establishing the system by the relevant third party provided for in Article 28, paragraph (1) of the Act; (ii) overview of the equivalent measures implemented by the relevant third party; (iii) frequency and methods for confirmation under paragraph (1), item (i); (iv) the name of the relevant foreign country; (v) presence and content of the relevant foreign country's systems that may affect implementation of the equivalent measures by the relevant third party; (vi) presence and overview of interference with the implementation of the equivalent measures by the relevant third party; (vii) overview of the measures taken by the business handling personal information pursuant to paragraph (1), item (ii) with respect to the interference referred to in the preceding item. (4) When a business handling personal information decides not to provide all or part of the information concerning a request under Article 28, paragraph (3) of the Act, the business operator handling personal information must notify an identifiable person of that fact without delay. (5) When a business handling personal information gives notification of the fact that the business handling personal information does not provide all or part of the information requested by an identifiable person pursuant to the preceding paragraph, the business handling personal information must endeavor to explain the reason.

(Preparation of Records on Provision of Personal Data to Third Parties) Article 19 (1) A method of preparing a record referred to in Article 29, paragraph (1) of the Act is to be a method that prepares it by using a written document, electronic or magnetic record or microfilm. (2) A record referred to in Article 29, paragraph (1) of the Act must be prepared promptly each time personal data has been provided to a third party (meaning a third party provided for in that paragraph; the same applies in this Article, the following Article, Articles 22 through 24, and Articles 27 and 28) provided, however, that the record may be prepared together if personal data has been provided continuously or repeatedly to the third party (excluding a provision under Article 27, paragraph (2) of the Act; the same applies in this paragraph), or if it is considered to be a certainty that personal data will be provided continuously or repeatedly to the third party. (3) Notwithstanding the provisions of the preceding paragraph, in cases where personal data relating to an identifiable person has been provided to a third party in connection with supplying goods or services to the identifiable person pursuant to Article 27, paragraph (1) of the Act or Article 28, paragraph (1) of the Act and when the matters prescribed in the items of paragraph (1) of the following Article are stated in a written agreement or other document produced in connection with the supply, that document may substitute for a record relating to the matter referred to in Article 29, paragraph (1) of the Act.

(Matters to be Recorded Concerning Provision of Personal Data to Third Parties) Article 20 (1) The matters prescribed by Rules of the Personal Information Protection Commission under Article 29, paragraph (1) of the Act are to be those prescribed in the following items in accordance with the categories of the cases stated in those items: (i) cases in which personal data has been provided to a third party pursuant to Article 27, paragraph (2) of the Act: the matters stated in the following (a) through (d): (a) the date when the personal data was provided; (b) the name and address of the third party and, if it is a corporation, the name of its representative (or for an organization without legal personality for which a representative or administrator has been designated, the name of the representative or manager; the same applies in Article 28, paragraph (1), item (iii)) (when provided to a large number of unspecified persons, a statement to that effect); (c) the name of a person identifiable by the personal data, or other matters sufficient for specifying the person; (d) the details of the personal data. (ii) cases in which personal data has been provided to a third party pursuant to Article 27, paragraph (1) of the Act or Article 28, paragraph (1) of the Act: the matters stated in the following (a) and (b): (a) the fact to the effect that an identifiable person's consent referred to in Article 27, paragraph (1) of the Act or Article 28, paragraph (1) of the Act has been obtained; (b) the matters stated in (b) through (d) under the preceding item. (2) Regarding those matters provided in the items of the preceding paragraph which are identical in content to those matters that have been recorded in a record referred to in Article 29, paragraph (1) of the Act that was already prepared by using a method prescribed in the preceding Article (limited to those in the case of the record having been maintained), a record on those matters referred to in that paragraph may be omitted.

(Period for Keeping Records on Provision of Personal Data to Third Parties) Article 21 The period prescribed by Rules of the Personal Information Protection Commission under Article 29, paragraph (2) of the Act is to be a period prescribed in the following items in accordance with the categories of the cases stated in those items: (i) cases in which a record was prepared by using a method prescribed in Article 19, paragraph (3): a period up to the day on which one year has passed from the last date on which personal data relating to the record is provided; (ii) cases in which a record was prepared by using a method prescribed in the proviso of Article 19, paragraph (2): a period up to the day on which three years have passed from the last date on which personal data relating to the record was provided; (iii) cases other than the preceding two items: three years.

(Confirmation on Receiving Personal Data from a Third Party) Article 22 (1) A method of confirming the matters stated in Article 30, paragraph (1), item (i) of the Act under that paragraph is to be an appropriate method such as receiving a declaration from a third party who provides personal data. (2) A method of confirming the matters stated in Article 30, paragraph (1), item (ii) of the Act under that paragraph is to be an appropriate method such as receiving, from a third party, a written agreement or other document showing the background of the acquisition of the personal data by the third party. (3) Notwithstanding the provisions of the preceding two paragraphs, a method of confirming the matters which have already been confirmed when receiving other personal data from a third party by using the method prescribed in the preceding two paragraphs (limited to those in cases where a record has been prepared and maintained by using a method prescribed in the following Article relating to the confirmation) is to be a method confirming that the contents of those matters are identical to the contents of matters stated in each item of Article 30, paragraph (1) of the Act relating to that provision.

(Preparing of Records Regarding Confirmation on Receiving Personal Data from a Third Party) Article 23 (1) A method of preparing a record referred to in Article 30, paragraph (3) of the Act under that paragraph is to be a method preparing it by using a written document, electronic or magnetic record or microfilm. (2) A record referred to in Article 30, paragraph (3) of the Act must be prepared promptly each time a business operator handling personal information has received provision of personal data from a third party provided, however, that the record may be prepared together if personal data has been received continuously or repeatedly from the third party (excluding for provision under Article 27, paragraph (2) of the Act; the same applies below in this Article), or if it is considered to be a certainty that personal data will be received continuously or repeatedly from the third party. (3) Notwithstanding the provisions of the preceding paragraph, in cases where a business operator handling personal information has received the personal data relating to an identifiable person from a third party in connection with supplying goods or services to the identifiable person and when a matter prescribed in the items of paragraph (1) of the following Article is stated in a written agreement or other document produced in connection with the supply, that document may substitute for a record relating to the matters referred to in Article 30, paragraph (3) of the Act.

(Matters to Be Recorded when Receiving Personal Data from a Third Party) Article 24 (1) The matters prescribed by Rules of the Personal Information Protection Commission under Article 30, paragraph (3) of the Act are to be those prescribed in the following items in accordance with the categories of the cases stated in those items: (i) cases in which a business handling personal information has received personal data from another business handling personal information under Article 27, paragraph (2) of the Act; the matters stated in the following (a) through (e): (a) the date when the business handling personal information received the personal data; (b) the matters stated in each item of Article 30, paragraph (1) of the Act; (c) the name of a person identifiable by the personal data and other matters sufficient for specifying the person; (d) the details of the personal data; (e) the fact to the effect that disclosure has been made pursuant to Article 27, paragraph (4) of the Act. (ii) in cases of having received personal data from a business handling personal information under Article 27, paragraph (1) of the Act or Article 28, paragraph (1) of the Act; the matters stated in the following (a) and (b): (a) the fact to the effect that an identifiable person's consent referred to in Article 27, paragraph (1) of the Act or Article 28, paragraph (1) of the Act has been obtained; (b) the matters stated in (b) through (d) under the preceding item. (iii) in cases in which information related to an individual is provided by a business handling information related to an individual under Article 31, paragraph (1) of the Act, and acquired as personal data; the matters stated in the following (a) through (d): (a) the fact to the effect that an identifiable person's consent referred to in Article 31, paragraph (1), item (i) of the Act has been obtained; and for a business handling personal information in a foreign country, the fact to the effect that information is provided under item (ii) of that paragraph; (b) matters stated in Article 30, paragraph (1), item (i) of the Act; (c) matters stated in item (i), (c); (d) the details of the information related to an individual. (iv) cases in which personal data has been received from a third party (excluding a person falling under a business handling personal information): the matters stated in (b) through (d) of item (i) (2) Regarding those matters prescribed in the items of the preceding paragraph which are identical in contents to those matters contained in a record referred to in Article 30, paragraph (3) of the Act (limited to those in the case of the record having been maintained) already prepared by using a method prescribed in the preceding Article, a record on those matters referred to in that paragraph may be omitted.

(Period for Keeping Records on Receiving Personal Data from a Third Party) Article 25 The period prescribed by order of the Personal Information Protection Commission under Article 30, paragraph (4) of the Act means a period prescribed in the following items in accordance with the categories of the cases stated in those items: (i) cases in which a record was prepared by using a method prescribed in Article 23, paragraph (3): a period up to the day on which one year has passed from the last date on which a business handling personal information receives the personal data relating to the record; (ii) cases in which a record was prepared by using a method prescribed in the proviso of Article 23, paragraph (2): a period up to the day on which three years have passed from the last date on which a business handling personal information receives the personal data relating to the record; (iii) cases other than the preceding two items: three years.

(Confirmation Concerning Providing Information Related to an Individual to Third Parties) Article 26 (1) A method of confirming the matters stated in Article 31, paragraph (1), item (i) of the Act under that paragraph means an appropriate method such as receiving a report from a third party who receives information related to an individual. (2) A method of confirming the matters stated in Article 31, paragraph (1), item (ii) of the Act under that paragraph is to be an appropriate method such as receiving presentation of documents showing that information is provided under that item. (3) Notwithstanding the provisions of the preceding two paragraphs, when providing information related to an individual to a third party, a method of confirming the matters which have already been confirmed by using the method prescribed in the preceding two paragraphs (limited to those in cases where a record has been prepared and maintained by using a method prescribed in the following Article relating to the confirmation) is to be a method confirming that the contents of those matters are identical to the contents of the matters stated in the items of Article 31, paragraph (1) of the Act.

(Preparing Records Related to Confirmation Concerning Providing Information Related to an Individual to a Third Party) Article 27 (1) The method of preparing a record referred to in Article 30, paragraph (3) of the Act under that paragraph as applied mutatis mutandis pursuant to Article 31, paragraph (3) of the Act following the deemed replacement of terms is to be a method that prepares the record by using a written document, electronic or magnetic record or microfilm. (2) A business handling information related to an individual must prepare a record referred to in Article 30, paragraph (3) of the Act as applied mutatis mutandis pursuant to Article 31, paragraph (3) of the Act following the deemed replacement of terms promptly each time the business handling information related to an individual provides information related to an individual to a third party provided, however, that the record may be prepared together if information related to an individual has been provided continuously or repeatedly to the third party, or if it is considered a certainty that information related to an individual will be provided continuously or repeatedly to the third party. (3) Notwithstanding the provisions of the preceding paragraph, in cases where information related to an individual relating to an identifiable person has been provided to a third party in connection with supplying goods or services to the identifiable person pursuant to Article 31, paragraph (1) of the Act and when matters prescribed in the items of paragraph (1) of the following Article are stated in a written agreement or other document produced in connection with the supply, that document may substitute for a record relating to the matter referred to in Article 30, paragraph (3) of the Act as applied mutatis mutandis pursuant to Article 31, paragraph (3) of the Act, following the deemed replacement of terms.

(Matters to be Recorded when Providing Information Related to an Individual to Third Parties) Article 28 (1) The matters prescribed by Rules of the Personal Information Protection Commission under Article 30, paragraph (3) of the Act, as applied mutatis mutandis pursuant to Article 31, paragraph (3) of the Act following the deemed replacement of terms, are to be those stated in the following: (i) the fact to the effect that a business handling information related to an individual has confirmed that an identifiable person's consent referred to in Article 31, paragraph (1), item (i) of the Act has been obtained; and for a third party in a foreign country, the fact to the effect that a business handling information related to an individual has confirmed that information has been provided under item (ii) of that paragraph; (ii) the date when a business handling information related to an individual provided the information related to an individual (if preparing a record referred to in Article 30, paragraph (3) of the Act in an integrated manner as applied mutatis mutandis pursuant to Article 31, paragraph (3) of the Act, following the deemed replacement of terms pursuant to the proviso of paragraph (2) of the preceding Article, the first and last day of the period of provision); (iii) the name and address of the third party and, if the third party is a corporation, the name of its representative; (iv) the details of the information related to an individual. (2) Regarding those matters prescribed in the items of the preceding paragraph which are identical in contents to those matters contained in a record referred to in Article 30, paragraph (3) of the Act as applied mutatis mutandis pursuant to Article 31, paragraph (3) of the Act following the deemed replacement of terms that was already prepared by using a method prescribed in the preceding Article (limited to those matters in the case of the record having been maintained), a record on those matters under Article 30, paragraph (3) of the Act as applied mutatis mutandis pursuant to Article 31, paragraph (3) of the Act following the deemed replacement of terms may be omitted.

(Period for Keeping Records on Provision of Information Related to an Individual to a Third Party) Article 29 The period prescribed by Rules of the Personal Information Protection Commission under Article 30, paragraph (4) of the Act as applied mutatis mutandis pursuant to Article 31, paragraph (3) of the Act is to be a period prescribed in the following items in accordance with the categories of the cases stated in those items: (i) cases in which a business handling information related to an individual prepared a record by using a method prescribed in Article 27, paragraph (3): a period up to the day on which one year has passed from the last date on which the business handling information related to an individual provides the information related to an individual relating to the record; (ii) cases in which a business handling information related to an individual prepared a record by using a method prescribed in the proviso of Article 27, paragraph (2): a period up to the day on which three years have passed from the last date on which the business handling information related to an individual provides information related to an individual relating to the record; (iii) cases other than the preceding two items: three years.

(Methods of Disclosure that an Identifiable Person May Requests) Article 30 The methods prescribed by Rules of the Personal Information Protection Commission under Article 33, paragraph (1) of the Act (including cases when applied mutatis mutandis pursuant to paragraph (5) of that Article) are to be methods using electronic or magnetic records, delivering documents or methods prescribed by the relevant business handling personal information.

(Standards in Methods for Preparation of Pseudonymized Personal Information) Article 31 The standards prescribed by Rules of the Personal Information Protection Commission under Article 41, paragraph (1) of the Act are as follows: (i) deleting all or part of the identifier or their equivalent which can identify a specific individual contained in personal information (including replacing all or the part of the identifier or the equivalent with another identifier or the equivalent by a method without regularity that enables their restoration); (ii) deleting all individual identification codes contained in personal information (including replacing the individual identification codes with another identifier or the equivalent by a method without regularity that enables their restoration of the individual identification codes); (iii) deleting the identifier or the equivalent contained in personal information that could cause property damage by being wrongfully used (including replacing the identifier or the equivalent with another identifier or the equivalent by a method without regularity that enables their restoration).

(Standards in Measures for Managing the Security of Deleted or Other Related Information) Article 32 The standards prescribed by Rules of the Personal Information Protection Commission under Article 41, paragraph (2) of the Act are as follows: (i) clearly defining the authority and responsibility of a person handling deleted or other related information provided for in Article 41, paragraph (2) of the Act (for information relating to a processing method pursuant to paragraph (1) of that Article, limited to methods which can restore personal information used to prepare pseudonymized personal information by using the information; the same applies below in this Article); (ii) establishing rules and procedures on the handling of deleted or other related information, appropriately handling deleted or other related information in accordance with the rules and procedures, evaluating the handling situation, and taking necessary measures to seek improvement based on the evaluation results; (iii) taking necessary and appropriate measures to prevent a person with no legitimate authority to handle deleted or other related information from handling the deleted or other related information.

(Electronic or Magnetic Means) Article 33 The electronic or magnetic means provided for in Article 41, paragraph (8) of the Act are as follows: (i) a means of transmitting electronic or magnetic records to a mobile communication terminal used by the counterparty by using a telephone number for transmission and receipt (including cases where other persons are entrusted to do so); (ii) a means of sending an email (including cases where other persons are entrusted to do so); (iii) in addition to the means provided for in the preceding item, a means sending telecommunications (meaning telecommunications as provided for in Article 2, item (i) of the Telecommunications Business Act (Act No. 86 of 1984)) used to transmit information by identifying a person who receives the transmission (including cases where other persons are entrusted to do so).

(Standards in Methods for Preparing Anonymized Personal Information) Article 34 The standards prescribed by Rules of the Personal Information Protection Commission under Article 43, paragraph (1) of the Act are as follows: (i) deleting all or part of an identifier or the equivalent which can identify a specific individual contained in personal information (including replacing all or the part of the identifier or the equivalent with other identifiers or their equivalent by a method without regularity that enables their restoration); (ii) deleting all individual identification codes contained in personal information (including replacing the individual identification codes with another identifier or the equivalent by a method without regularity that enables restoration of the individual identification codes); (iii) deleting the codes (limited to those mutually linking information being actually handled by a business operator handling personal information ) which link personal information and information obtained by having taken measures against the personal information (including replacing the codes with other codes which cannot link the personal information and information obtained by having taken measures concerning the personal information by a method without regularity that enables their restoration); (iv) deleting an idiosyncratic identifier or the equivalent (including replacing the idiosyncratic identifier or the equivalent with another identifier or the equivalent by a method without regularity that enables its restoration); (v) besides the measures stated in the preceding items, taking appropriate measures based on the results from considering the attribute of a personal information database, etc. such as the difference between the identifier or the equivalent contained in personal information and the identifier or the equivalent contained in other personal information constituting the same personal information database, etc.

(Standards in Measures for Managing the Security of Processing Method Related Information) Article 35 The standards prescribed by order of the Personal Information Protection Commission under Article 43, paragraph (2) of the Act are as follows: (i) clearly defining the authority and responsibility of a person handling processing method etc. related information (meaning information relating to the identifier or the equivalent. and individual identification codes which were deleted from personal information used to prepare anonymized personal information and information relating to a processing method carried out pursuant to Article 43, paragraph (1) of the Act (limited to information which can restore the personal information through the use of that information); the same applies below in this Article); (ii) establishing rules and procedures on the handling of processing method etc. related information, appropriately handling processing method etc. related information in accordance with the rules and procedures, evaluating the handling situation, and taking necessary measures to seek improvement based on the evaluation results; (iii) taking necessary and appropriate measures to prevent a person with no legitimate authority to handle processing method etc. related information from handling the processing method etc. related information.

(Public Annoucement by a Business Operator Handling Personal Information When Preparing Anonymized Personal Information) Article 36 (1) Public disclosure under Article 43, paragraph (3) of the Act is to be made by the use of the Internet or other appropriate methods, without delay after the anonymized personal information has been prepared. (2) In cases where a business handling personal information entrusted by another business handling personal information has prepared anonymized personal information, that other business handling personal information discloses the details of information on an individual contained in the anonymized personal information by a method prescribed in the preceding paragraph. In such cases, it is deemed that the public announcement of those details has been made by the public disclosure of that other business handling personal information.

(Public Disclosure by a Business Handling Personal Information When Providing Anonymized Personal Information to Third Parties) Article 37 (1) Public Disclosure under Article 43, paragraph (4) of the Act is to be made by the use of the Internet or other appropriate methods. (2) An explicit statement under Article 43, paragraph (4) of the Act is to be given by sending an email, delivering a written document or employing other appropriate methods.

(Public Announcement by a Business Handling Anonymized Personal Information When Providing Anonymized Personal Information to Third Parties) Article 38 (1) The provisions of paragraph (1) of the preceding Article, apply mutatis mutandis to public announcement under Article 44 of the Act. (2) The provisions of paragraph (2) of the preceding Article applies mutatis mutandis to an explicit statement pursuant under Article 44 of the Act.

(Minor Change) Article 39 A minor alternation prescribed by Order of the Personal Information Protection Commission under Article 50, paragraph (1) of the Act does not involve any substantial change in the content of the business as provided for in the items of Article 47, paragraph (1) of the Act.

(Notification of Personal Information Protection Guidelines) Article 40 A notification under Article 54, paragraph (2) of the Act is to be given in writing in accordance with Appended Form No. 5.

(Public Announcement of Personal Information Protection Guidelines by the Personal Information Protection Commission) Article 41 Public Announcement under Article 54, paragraph (3) of the Act is to be made by the use of the Internet or other appropriate methods.

(Public Announcement of Personal Information Protection Guidelines by a Certified Personal Information Protection Organization) Article 42 A certified personal information protection organization is to disclose to the public the personal information protection guidelines submitted pursuant to Article 54, paragraph (2) of the Act by the use of the Internet or other appropriate means, without delay after personal information protection guidelines have been disclosed to the public under paragraph (3) of that Article.

(Situations Likely to Harm Individual Rights and Interests) Article 43 The situations prescribed by Rules of the Personal Information Protection Commission as those that are highly likely to harm individual rights and interests under Article 68, paragraph (1) of the Act are to be those which fall under any of the following: (i) situations in which there was the occurrence of or the risk of occurrence of leakage, loss or damage (referred to below as "leakage, etc." in this Article and paragraph (1) of the following Article) of personal information the administrative body holds that contains sensitive personal information (excluding information for which advanced encryption or other necessary measures have been taken for protecting individual rights and interests; the same applies in this Article and paragraph (1) of the following Article); (ii) situations in which there was the occurrence of or the risk of occurrence of leakage, etc. of personal information the administrative body holds that could possibly cause property damage when the information is wrongfully used; (iii) situations in which there was the occurrence of or the risk of occurrence of leakage, etc. of personal information the administrative body holds (including personal information that an administrative body to which the head of an administrative body, etc. belongs has acquired or intends to acquire and that is going to be handled as personal information the administrative body holds) arising from an act conducted possibly for wrongful purposes, against the administrative body to which the head of an administrative, etc. belongs ; (iv) situations in which leakage, etc. of personal information the administrative body holds where the number of persons identifiable by the personal information exceeds 100 occurred or possibly occurred; (v) situations in which leakage, etc. of personal information the administrative body holds that contains sensitive personal information prescribed by local ordinance occurred or possibly occurred (limited to cases where local government body or local incorporated administrative agency make a report referred to in Article 68, paragraph (1) of the Act and sensitive personal information prescribed by local ordinance is prescribed in local ordinance which is applied to the local government body or the local incorporated administrative agency).

(Report to the Personal Information Protection Commission) Article 44 (1) When the head of an administrative body, etc. makes a report under Article 68, paragraph (1) of the Act, the head of the administrative body, etc. must report the matters stated in the following items regarding the situations prescribed in the items of the preceding Article (limited to those that the head of the administrative body, etc. is aware of when making the report) promptly after the head of the administrative body, etc. becomes aware of a situation: (i) overview; (ii) the details of personal information the administrative body holds (with regard to the situation specified in item (iii) of the preceding Article, including the personal information prescribed in that item; the same applies in the following item) for which leakage, etc. occurred or possibly occurred; (iii) the number of persons identifiable by personal information the administrative body holds for which leakage, etc. occurred or possibly occurred; (iv) causes; (v) whether there is or possibly be secondary damage, and the details; (vi) implementation status of measures in relation to identifiable persons; (vii) implementation status of public announcement; (viii) measures to prevent recurrence; (ix) other matters for reference. (2) In the case of the preceding paragraph, the head of an administrative body, etc. must report the matters prescribed in the items of the preceding paragraph regarding the relevant situation within 30 days from the time the head of the administrative body, etc. becomes aware of the relevant situation (or 60 days if the relevant situation is one prescribed by item (iii) of the preceding Article). (3) The report under Article 68, paragraph (1) of the Act is to be made by a method using an electronic data processing system (meaning an electronic data processing system connecting a computer used by the Personal Information Protection Commission and a computer used by a reporting person via telecommunication lines) (or a method submitting a report in accordance with Appended Form No. 6 if it is found to be difficult to use an electronic data processing system due to a fault in telecommunications lines, a disaster or other reasons).

(Notification to Identifiable Persons) Article 45 If the head of an administrative body, etc. gives a notification under the main clause of Article 68, paragraph (2) of the Act, the head of the administrative body, etc. must promptly notify the matters prescribed by items (i), (ii), (iv), (v) and (ix) of the preceding Article, paragraph (1) to the extent necessary for protecting the rights and interests of the relevant identifiable person promptly after becoming aware of the situation provided for in the items of Article 43, depending on the relevant situation.

(Foreign Country That Has Established a Personal Information Protection System Recognized to Have Equivalent Standards to That in Japan Regarding the Protection of Individual Rights and Interests) Article 45-2 (1) The country prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system under Article 71, paragraph (1) of the Act means a country that the Personal Information Protection Commission prescribes as being a foreign country that falls under all of the following items: (i) has established a law, regulation or other rules equivalent to the provisions regarding business handling personal information under the Act, and its status is such that there are reasonable grounds to believe that they have been enforced in the foreign country; (ii) has established an independent foreign enforcement authority equivalent to the Personal Information Protection Commission, and has established a system for the foreign enforcement authority to provide necessary and appropriate supervision; (iii) is recognized to have the ability to collaborate and cooperate with Japan based on mutual understanding regarding the proper and effective application of personal information and the protection of individual rights and interests; (iv) is recognized to have the ability to transfer the personal information the administrative body holds mutually and smoothly between itself and Japan while ensuring the protection of the personal information the administrative body holds without restricting the international transfer of such personal information beyond the extent necessary for protecting it; (v) in addition to those matters provided for in the preceding four items, it is recognized that specifying the country as a foreign country under Article 71, paragraph (1) of the Act will contribute to the creation of new industries and the realization of a vibrant economic society and an enriched life of the Japanese public. (2) When the Personal Information Protection Commission finds it necessary for protecting individual rights and interests in Japan in prescribing a country as the foreign country under the preceding paragraph, the Commission can limit the range of the personal information the administrative body holds that can be provided to a third party in a foreign country without obtaining an identifiable person's consent to that effect that the person permit the provision of the information and can add other necessary conditions. (3) When the Personal Information Protection Commission has prescribed a foreign country under paragraph (1), and finds it necessary to confirm whether the foreign country falls under any item of paragraph (1) and whether conditions added pursuant to the preceding paragraph for the foreign country have been met, the Commission is to perform necessary investigations on the foreign country's systems for protecting personal information or on the corresponding status regarding the conditions. (4) When the Personal Information Protection Commission has prescribed a foreign country under paragraph (1), and recognizes that the foreign country no longer falls under any item of paragraph (1) or that conditions added pursuant to paragraph (2) for the foreign country are no longer being met, taking into account the results of the investigations in the preceding paragraph and other situations, the Commission is to revoke the specification under paragraph (1).

(Standards in the System Necessary for Continuously Taking Measures Equivalent to those that a Business Operator Handling Personal Information Are Expected to Take) Article 46 The standards prescribed by order of the Personal Information Protection Commission under Article 71, paragraph (1) of the Act are to fall under any of the following items: (i) Concerning the handling of the personal information that a person has received from the head of an administrative body, etc. that holds the information, the head of the administrative body, etc. has ensured with the person that measures are being implemented in line with the purport of the provisions under Chapter IV, Section 2 of the Act by an appropriate and reasonable method.; (ii) a person who receives personal information the administrative body holds has obtained certification based on an international framework concerning the handling of personal information.

(Provision of Information When Obtaining Consent Concerning Provision to a Third Party in a Foreign Country) Article 47 Methods of providing information pursuant to Article 71, paragraph (2) of the Act are methods by the provision of electronic or magnetic records, delivering documents or other appropriate methods. (2) Provision of information under Article 71, paragraph (2) of the Act is conducted for the following matters: (i) name of the relevant foreign country; (ii) information on a personal information protection system in the relevant foreign country obtained in an appropriate and reasonable manner; (iii) information on measures taken by the relevant third party to protect personal information. (3) Notwithstanding the provisions of the preceding paragraph, if the head of an administrative body, etc. cannot identify the matter provided for in item (i) of the preceding paragraph, when attempting to obtain consent from an identifiable person pursuant to Article 71, paragraph (1) of the Act, the head of the administrative body, etc. must provide information on the following matters instead of the matters provided for in that item and item (ii) of that paragraph: (i) the fact that the matter provided for in item (i) of the preceding paragraph cannot be identified and its reason; (ii) if there is information that is to serve as a reference to an identifiable person in place of the matter provided for in item (i) of the preceding paragraph, that information. (4) Notwithstanding the provision of paragraph (2), if the head of an administrative body, etc. cannot provide information on the matter provided for in paragraph (2), item (iii) when attempting to obtain consent from an identifiable person pursuant to Article 71, paragraph (1) of the Act, the head of the administrative body, etc. must provide information on the fact and the reason instead of the matter provided for in that item.

(Measures Necessary to Ensure Continuous Implementation of Equivalent Measures by a Third Party in a Foreign Country) Article 48 (1) Necessary measures to ensure continuous implementation of the equivalent measures by a third party in a foreign country under Article 71, paragraph (3) of the Act are as follows: (i) to periodically check the implementation status of the equivalent measures by the third party and the presence and content of the foreign country's systems that may affect implementation of the equivalent measures in an appropriate and reasonable manner; (ii) to take necessary and appropriate measures when the third party fails to implement the equivalent measures; and to discontinue the provision of personal information the administrative body holds to the third party when it becomes difficult to ensure the continuous implementation of the equivalent measures. (2) The methods of providing information pursuant to Article 71, paragraph (3) of the Act are methods by provision of electronic or magnetic records, delivering documents or other appropriate methods. (3) If the head of an administrative body, etc. receives a request under Article 71, paragraph (3) of the Act, the head of the administrative body, etc. must provide information on the following matters to an identifiable person without delay provided, however, that if providing the information is likely to hinder the proper execution of the processes or services of the administrative body, etc. to which the head of the administrative body, etc. belongs, the head of the administrative body, etc. may not provide all or part of the information: (i) methods for establishing the system by the relevant third party provided for in Article 71, paragraph (1) of the Act; (ii) overview of the equivalent measures implemented by the relevant third party; (iii) frequency and methods for confirmation under paragraph (1), item (i); (iv) the name of the relevant foreign country; (v) presence and content of the relevant foreign country's systems that may affect implementation of the equivalent measures by the relevant third party; (vi) presence and overview of interference with the implementation of the equivalent measures by the relevant third party; (vii) overview of the measures taken by the head of an administrative body, etc. pursuant to paragraph (1), item (ii) with respect to the interference referred to in the preceding item. (4) When the head of an administrative body, etc. decides not to provide all or part of the information concerning a request under Article 71, paragraph (3) of the Act, the head of the administrative body, etc. must notify an identifiable person of that fact without delay. (5) When the head of an administrative body, etc. gives notification of the fact that the head of the administrative body, etc. does not provide all or part of the information requested by an identifiable person pursuant to the preceding paragraph, the head of the administrative body, etc. must endeavor to explain the reason to that person.

(Electronic or Magnetic Means) Article 49 The electronic or magnetic means provided for in Article 73, paragraph (4) of the Act are as follows: (i) a means of transmitting electronic or magnetic records to a mobile communication terminal used by the counterparty by using a telephone number for transmission and receipt (including cases where other people are entrusted to do so); (ii) a means of sending an email (including cases where other people are entrusted to do so); (iii) in addition to the means provided for in the preceding item, a means of sending telecommunications (meaning telecommunications as provided for in Article 2, item (i) of the Telecommunications Business Act) used to transmit information by identifying a person who receives the transmission (including cases where other persons are entrusted to do so).

(Matters Prescribed by Order of the Personal Information Protection Commission under Article 20, paragraph (1), item (ii) of the Cabinet Order) Article 50 The matters prescribed by order of the Personal Information Protection Commission under Article 20, paragraph (1), item (ii) of the Cabinet Order are to be those stated in the following: (i) when a special procedure is prescribed by the provisions of other laws and regulations provided for in the proviso of Article 90, paragraph (1) of the Act or the proviso of Article 98, paragraph (1) of the Act, the provisions of the laws and regulations; (ii) when attempting to change the matters for which notification has already given pursuant to Article 74, paragraph (1) of the Act, the scheduled date of the change.

(Method of Paying Fees Related to Disclosure Requests Using Information and Communications Technology) Article 51 The method using an electronic data processing system or another method using information and communications technology specified by order of the competent ministry prescribed by Article 6, paragraph (5) of the Act on the Advancement of Government Administration Processes That Use Information and Communications Technology (Act No. 151 of 2002) in the cases prescribed by Article 27, paragraph (1), item (ii) of the Cabinet Order is a method paying fees using payment information obtained by the request for disclosure prescribed by that item.

(Method of Paying Expenses Required for Sending Copies) Article 52 The methods provided for in order of the Personal Information Protection Commission under Article 28, paragraph (1) of the Cabinet Order are as follows: (i) a method of payment using postage stamps or similar certificates specified by the Personal Information Protection Commission; (ii) in cases where a request is made under Article 87, paragraph (3) of the Act by using an electronic data processing system prescribed by Article 6, paragraph (1) of the Act on the Advancement of Government Administration Processes That Utilize Information and Communications Technology pursuant to that paragraph, a method of payment using payment information obtained from the request.

(Method of Requesting Proposals) Article 53 (1) The request for proposals under Article 111 of the Act is made at least once every fiscal year, specifying a period of no less than 30 days from the date of the commencement of the request, and is made by using the internet or other appropriate means. (2) Any necessary matters relating to the request for proposals are to be announced to the public in advance.

(Method of Proposals) Article 54 (1) The proposal under Article 112, paragraph (1) of the Act is to be made in accordance with Appended Form No. 7. (2) If an agent makes the proposal under the preceding paragraph, a document that certifies the authority of the agent is to be attached to Appended Form No. 7. (3) The matters prescribed by order of the Personal Information Protection Commission under Article 112, paragraph (2), item (viii) of the Act are to be desired methods of information provision regarding anonymized personal information the administrative body holds related to the proposal. (4) The documents specified by Rules of the Personal Information Protection Commission under Article 112, paragraph (3) of the Act are as follows: (i) if the person making the proposal is an individual, a copy of the following, which contains the name and address or residence identical to the name and address or residence of the individual: a driver's license, an individual number card as prescribed in Article 2, paragraph (7) of the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (Act No. 27 of 2013), a residence card as prescribed in Article 19-3 of the Immigration Control and Refugee Recognition Act (Cabinet Order No. 319 of 1951), a special permanent resident certificate as prescribed in Article 7, paragraph (1) of the Special Act on the Immigration Control of, inter alia, those who have lost Japanese Nationality pursuant to the Treaty of Peace with Japan (Act No. 71 of 1991), or a document delivered pursuant to the provisions of laws or an order based on the laws sufficiently verifying the identity of the person making a proposal; (ii) if the person making the proposal is a corporation or other organization, a certificate of registered information or a certificate of seal registration which contains the identical name, address of the head office or principal office, and the identical name of the representative, with the person's name, the address of its head office or principal office, and the name of the person's representative, and which is created within 6 months before the date of proposal, or a document delivered pursuant to the provision of laws or an order based on the law, sufficiently verifying the identity of the person making the proposal; (iii) if the person making the proposal cannot attach the document stated in the preceding two items for compelling reasons, a document deemed appropriate by the head of an administrative body, etc. to verify that the person making the proposal is the identifiable person; (iv) in addition to the documents stated in the preceding items, any other documents deemed necessary by the head of an administrative body, etc. (5) The provisions of the preceding paragraph are applied mutatis mutandis when an agent makes a proposal under paragraph (1). In this case, the term "the person making the proposal" in the provision of items (i) through (iii) of the preceding paragraph is replaced with "the agent". (6) A document referred to in Article 112, paragraph (3), item (i) of the Act (including cases where applied mutatis mutandis pursuant to Article 118, paragraph (2) of the Act) is to be made in accordance with Appended Form No. 8. (7) When the head of an administrative body, etc. finds that a document submitted pursuant to Article 112, paragraph (2) of the Act or attached pursuant to paragraph (3) of that Article is incomplete, or that the description of the matters to be stated in these documents is insufficient, the head of the administrative body, etc. may request an explanation from the person or agent making the proposal under paragraph (1) of that Article, or request a correction of the document.

(Person Unable to Properly Conduct Business Which Uses Anonymized Personal Information an Administrative Body Holds Due to the Person's Mental or Physical Disorder) Article 55 A person specified by Rules of the Personal Information Protection Commission under Article 113, item (ii) of the Act is a person who is unable to properly perform the recognition, judgment and communication necessary for properly conducting business which uses anonymized personal information an administrative body holds due to mental impairment.

(Number of Persons Identifiable by Anonymized Personal Information an Administrative body Holds Relating to a Proposal) Article 56 The number specified by Rules of the Personal Information Protection Commission under Article 114, paragraph (1), item (ii) of the Act is 1,000.

(Period During Which Anonymized Personal Information an Administrative Body Holds Relating to a Proposal is Used for Business) Article 57 The period specified by Rules of the Personal Information Protection Commission under Article 114, paragraph (1), item (v) of the Act means the necessary period taking into account the business referred to in Article 112, paragraph (2), item (v) of the Act and the purpose and method of use of anonymized personal information the administrative body holds related to the proposal referred to in that item.

(Other Criteria for Proposal-Related Examinations) Article 58 The criteria prescribed by Rules of the Personal Information Protection Commission under Article 114, paragraph (1), item (vii) of the Act is not to seriously interfere with the affairs or service of an administrative body to which the head of an administrative body, etc. belongs, when the head of the administrative body, etc. prepares anonymized personal information the administrative body holds relating to the proposal.

(Method of Notifying Results of Examination and Matters to be Notified) Article 59 A notice under Article 114, paragraph (2) of the Act is to be made in accordance with Appended Form No. 9 along with the documents stated in the following: (i) a document regarding an application to conclude a contract for the use of anonymized personal information the administrative body holds under Article 115 of the Act (including cases where applied mutatis mutandis in Article 118, paragraph (2) of the Act) which was prepared in accordance with Appended Form No. 10; (ii) a document relating to the conclusion of the contract referred to in the preceding item. (2) The matters prescribed by Rules of the Personal Information Protection Commission under Article 114, paragraph (2), item (ii) of the Act are as follows: (i) amount of fees or usage fees to be paid (referred to below as "fees, etc." in this paragraph); (ii) method of paying fees, etc.; (iii) deadline for paying fees, etc.; (iv) method of providing anonymized personal information the administrative body holds. (3) A notice under Article 114, paragraph (3) of the Act is to be made by notification in accordance with Appended Form No. 11.

(Method of Paying Fees to an Administrative Body) Article 60 (1) The document prescribed by order of the Personal Information Protection Commission under Article 31, paragraph (3) of the Cabinet Order is to be Appended Form No. 10 under paragraph (1) of the preceding Article. (2) The method using electronic data processing systems or another method using information and communications technology specified by order of the competent ministry prescribed by Article 6, paragraph (5) of the Act on the Advancement of Government Administration Processes that Utilize Information and Communications Technology in relation to the payment of fees provided for in Article 31, paragraph (3) of the Cabinet Order means a method paying fees using payment information obtained by submitting the document referred to in the preceding Article, paragraph (1) provided, however, that when it is deemed appropriate to make payment using the following methods, the head of administrative body may specify the following methods in addition to the method of making payment using the payment information: (i) a method of making payment by affixing revenue stamps to a document designated by the head of the administrative body; (ii) for an administrative body or division or institution stated in the items of Article 31, paragraph (3) of the Cabinet Order, a method of payment by using the Appended Form of the Ministerial Order on Special Measures for the Procedures for Paying Fees Based on the Acts on Access to Information Held by Administrative Bodies (Ministry of Finance Order No. 10 of 2001).

(Conclusion of a Contract for the Use of Anonymized Personal Information the Administrative Body Holds) Article 61 A contract for the use of anonymized personal information the administrative body holds under Article 115 of the Act is to be concluded by submitting the documents referred to in Article 59, paragraph (1).

(Standards in Methods for Preparing Anonymized Personal Information the Administrative Body Holds) Article 62 The standards prescribed by Rules of the Personal Information Protection Commission under Article 116, paragraph (1) of the Act are as follows: (i) deleting all or part of the identifier or the equivalent which can identify a specific individual contained in personal information the administrative body holds (including replacing all or the part of the identifier or the equivalent with another identifier or the equivalent by a method without regularity that enables their restoration); (ii) deleting all individual identification codes contained in personal information the administrative body holds (including replacing the individual identification codes with other identifier or the equivalent by method without regularity that enables restoration of the individual identification codes); (iii) deleting the codes (limited to those mutually linking information being actually handled by an administrative body) which link personal information the administrative body holds and information obtained by having taken measures against the personal information the administrative body holds (including replacing the codes with other codes which cannot link the personal information the administrative body holds and information obtained by having taken measures against the personal information the administrative body holds by method without regularity that enables their restoration); (iv) deleting idiosyncratic identifiers or their equivalent (including replacing the idiosyncratic identifiers or the equivalent with other identifiers or the equivalent without regularity that enables their restoration); (v) besides the measures stated in the preceding items, taking appropriate measures based on the results from considering the attributes of the personal information files, such as differences between identifiers or the equivalent contained in personal information the administrative body holds and identifiers or the equivalent contained in other personal information the administrative body holds constituting the personal information files that encompass the relevant personal information the administrative body holds.

(Matters to be Registered in the Personal Information File Register of Anonymized Personal Information the Administrative Body Holds) Article 63 The matters specified by Rules of the Personal Information Protection Commission under Article 117, item (i) of the Act are the number of identifiable persons of anonymized personal information the administrative body holds and the details of the information contained in the anonymized personal information the administrative body holds.

(Mutatis Mutandis Application) Article 64 The provisions under Article 54 (excluding paragraph (6) of that Article), Article 55, Article 57, and Article 59 (excluding paragraph (1), item (i) of that Article) through Article 61 are applied mutatis mutandis when making a proposal under Article 118, paragraph (1) of the Act. In this case, "Appended Form No. 7" under Article 54, paragraphs (1) and (2) is replaced with "Appended Form No. 12"; "Appended Form No. 9" under Article 59, paragraph (1) is replaced with "Appended Form No. 13"; and "Appended Form No. 11" under Article 59, paragraph (3) is replaced with "Appended Form No. 14".

(Standards in Measures for Managing the Security of Anonymized Personal Information and Other Related Information of an Administrative Body) Article 65 The standards specified by Rules of the Personal Information Protection Commission under Article 121, paragraph (2) of the Act as follows: (i) clearly defining the authority and responsibility of a person handling anonymized personal information and other related information of an administrative body; (ii) establishing rules and procedures on the handling of anonymized personal information or other related information of an administrative body, appropriately handling anonymized personal information or other related information of an administrative body in accordance with the rules and procedures, evaluating the handling situation, and taking necessary measures to seek improvement based on the evaluation results; (iii) taking necessary and appropriate measures to prevent a person with no legitimate authority to handle anonymized personal information or other related information of an administrative body from handling the anonymized personal information or other related information of an administrative body.

(Obligations on Handling of Anonymized Personal Information) Article 66 (1) Public Announcement under Article 123, paragraph (1) of the Act is to be made by use of the Internet or other appropriate methods. (2) An explicit statement under Article 123, paragraph (1) of the Act is to be given by sending an email, delivering a written document or employing other appropriate methods.

(Standards in Measures for Managing the Security of Anonymized Personal Information) Article 67 The standards specified by Rules of the Personal Information Protection Commission under Article 123, paragraph (3) of the Act are to be as follows: (i) clearly defining the authority and responsibility of a person handling anonymized personal information (excluding anonymized personal information the administrative body holds; the same applies below in this Article); (ii) establishing rules and procedures on the handling of anonymized personal information, appropriately handling anonymized personal information in accordance with the rules and procedures, evaluating the handling situation, and taking necessary measures to seek improvement based on the evaluation results; (iii) taking necessary and appropriate measures to prevent a person with no legitimate authority to handle anonymized personal information from handling the anonymized personal information.

(Documents Specified by order of the Personal Information Protection Commission under Article 161, paragraph (1) of the Act) Article 68 The documents specified by Rules of the Personal Information Protection Commission under Article 161, paragraph (1) of the Act are to be the documents prescribed in the following items in accordance with the categories of the exercise of authority stated in those items: (i) for requests for submission of necessary information or material under Article 146, paragraph (1) of the Act, or for the calling for reports under Article 153 of the Act: documents that state the details and reason for the request or calling; (ii) recommendations under Article 148, paragraph (1) of the Act; documents that notes the details and reasons for the recommendations; (iii) an order under Article 148, paragraph (2) or paragraph (3) of the Act, an order under Article 154 of the Act, or rescission under Article 155, paragraph (1) of the Act; documents that state the details of the adverse dispositions, the provisions of laws and regulations that serve as the ground for the dispositions, and the facts comprising the causes of the dispositions.

(Manner of Effecting Service by Publication) Article 69 The Personal Information Protection Commission may publish, in an official gazette or a newspaper, the fact that service by publication has been made. Regarding service to be made in a foreign country, the Personal Information Protection Commission may give a notice of the fact that service by publication has been made, in lieu of publishing it in an official gazette or a newspaper.

(Notification When Prefectural or Municipal Ordinances are Prescribed) Article 70 The notification under Article 167, paragraph (1) of the Act is to be made by a method using an electronic data processing system (meaning an electronic data processing system connecting a computer used by the Personal Information Protection Commission and a computer used by a notifying person via telecommunication lines) (or a method submitting a report in accordance with Appended Form No. 15 if it is found to be difficult to use an electronic data processing system due to a fault in telecommunications lines, a disaster or other reasons). Appended Form No. 1 (Re: Article 8, paragraph (3)) [Omitted] Appended Form No. 2 (Re: Article 11, paragraph (2)) [Omitted] Appended Form No. 3 (Re: Article 11, paragraph (2)) [Omitted] Appended Form No. 4 (Re: Article 11, paragraph (3)) [Omitted] Appended Form No. 5 (Re: Article 40) [Omitted] Appended Form No. 6 (Re: Article 44, paragraph (3)) [Omitted] Appended Form No. 7 (Re: Article 54, paragraph (1)) [Omitted] Appended Form No. 8 (Re: Article 54, paragraph (6)) [Omitted] Appended Form No. 9 (Re: Article 59, paragraph (1)) [Omitted] Appended Form No. 10 (Re: Article 59, paragraph (1)) [Omitted] Appended Form No. 11 (Re: Article 59, paragraph (3)) [Omitted] Appended Form No. 12 (Re: Article 54, paragraph (1) as applied mutatis mutandis pursuant to Article 64 following the deemed replacement of terms) [Omitted] Appended Form No. 13 (Re: Article 59, paragraph (1) as applied mutatis mutandis pursuant to Article 64 following the deemed replacement of terms) [Omitted] Appended Form No. 14 (Re: Article 59, paragraph (3) as applied mutatis mutandis pursuant to Article 64 following the deemed replacement of terms) [Omitted] Appended Form No. 15 (Re: Article 70) [Omitted]